Configuring the Sentry Service

Before Enabling the Sentry Service

• Ensure you satisfy all the Prerequisites for the Sentry service.

• Setting Hive Warehouse Directory Permissions

  The Hive warehouse directory (/user/hive/warehouse or any path you specify as hive.metastore.warehouse.dir in your hive-site.xml) must be owned by the Hive user and group.
  • Using the default Hive warehouse directory - Permissions on the warehouse directory must be set as follows (see following Note for caveats):
    • 771 on the directory itself (by default, /user/hive/warehouse)
    • 771 on all subdirectories (for example, /user/hive/warehouse/mysubdir)
    • All files and subdirectories should be owned by hive:hive
    For example:

    $ sudo -u hdfs hdfs dfs -chmod -R 771 /user/hive/warehouse
    $ sudo -u hdfs hdfs dfs -chown -R hive:hive /user/hive/warehouse

    If you have enabled Kerberos on your cluster, you must kinit as the hdfs user before you set permissions. For example:

    sudo -u hdfs kinit -kt <hdfs.keytab> hdfs
    sudo -u hdfs hdfs dfs -chmod -R 771 /user/hive/warehouse
    $ sudo -u hdfs hdfs dfs -chown -R hive:hive /user/hive/warehouse

  • Using a non-default Hive warehouse: If you would like to use a different directory as the Hive warehouse, update the hive.metastore.warehouse.dir property, and make sure you set the required permissions on the new directory. For example, if the new warehouse directory is /data, set the permissions as follows:

    $ hdfs dfs -chown hive:hive /data
    $ hdfs dfs -chmod 771 /data

    Note that when you update the default Hive warehouse, previously created tables will not be moved over automatically. Therefore, tables created before the update will remain at /user/hive/warehouse/<old_table>. However, after the update, any new tables created in the default location will be found at /data/<new_table>.

    For Sentry/HDFS sync to work as expected, add the new warehouse URL to the list of Sentry Synchronization Path Prefixes.

• Disable impersonation for HiveServer2 in the Cloudera Manager Admin Console. Impersonation in HiveServer2 allows users to execute queries and access HDFS files as the connected user rather than the super user who started the HiveServer2 daemon. This enforces an access control policy at the file level using HDFS file permissions or ACLs. Keeping impersonation enabled means Sentry does not have end-to-end control over the authorization process. While Sentry can enforce access control policies on tables and views in the Hive warehouse, it has no control over permissions on the underlying table files in HDFS. Hence, even if users do not have the Sentry privileges required to access a table in the warehouse, as long as they have permission to access the corresponding table file in HDFS, any jobs or queries submitted will bypass Sentry authorization checks and execute successfully. Use the following instructions to disable impersonation:
  1. Go to the Hive service.
  2. Click the Configuration tab.
  3. Select Scope > HiveServer2.
  4. Select Category > Main.
  5. Uncheck the HiveServer2 Enable Impersonation checkbox.
  6. Click Save Changes to commit the changes.
• If you are using MapReduce, enable the Hive user to submit MapReduce jobs.
  1. Open the Cloudera Manager Admin Console and go to the MapReduce service.
  2. Click the Configuration tab.
  3. Select Scope > TaskTracker.
  4. Select Category > Security.
  5. Set the Minimum User ID for Job Submission property to zero (the default is 1000).
  6. Click Save Changes to commit the changes.
  7. Repeat steps 1-6 for every TaskTracker role group for the MapReduce service that is associated with Hive.
  8. Restart the MapReduce service.
• If you are using YARN, enable the Hive user to submit YARN jobs.
  1. Open the Cloudera Manager Admin Console and go to the YARN service.
  2. Click the Configuration tab.
  3. Select Scope > NodeManager.
  4. Select Category > Security.
  5. Ensure the Allowed System Users property includes the hive user. If not, add hive.
  6. Click Save Changes to commit the changes.
  7. Repeat steps 1-6 for every NodeManager role group for the YARN service that is associated with Hive.
  8. Restart the YARN service.

• Block the external applications from accessing the Hive metastore:

  1. In the Cloudera Manager Admin Console, select the Hive service.
  2. On the Hive service page, click the Configuration tab.
  3. In the search well on the right half of the Configuration page, search for Hive Metastore Access Control and Proxy User Groups Override to locate the hadoop.proxyuser.hive.groups parameter and click the plus sign.
  4. Enter hive into the text box and click the plus sign again.
  5. Enter hue into the text box.
  6. Click Save Changes.

  Setting this parameter blocks access to the Hive metastore for non-service users. This effectively disables Hive CLI, Spark, and Sqoop applications from interacting with the Hive service. These application will still run, but after setting this parameter as described here, they will no longer be able to access the Hive metastore and all Hive queries will fail. Users running these tools must be part of the hive or hue groups to access the Hive service. To allow greater access, additional user groups must be added to the proxy list.

Enabling the Sentry Service for Hive

1. Go to the Hive service.
2. Click the Configuration tab.
3. Select Scope > Hive (Service-Wide).
4. Select Category > Main.
5. Locate the Sentry Service property and select Sentry.
6. Click Save Changes to commit the changes.
7. Restart the Hive service.

Enabling the Sentry Service for Impala

1. Enable the Sentry service for Hive (as instructed above).
2. Go to the Impala service.
3. Click the Configuration tab.
4. Select Scope > Impala (Service-Wide).
5. Select Category > Main.
6. Locate the Sentry Service property and select Sentry.
7. Click Save Changes to commit the changes.
8. Restart Impala.

Enabling the Sentry Service for Solr

1. Go to the Solr service.
2. Click the Configuration tab.
3. Select Scope > Solr (Service-Wide).
4. Select Category > Main.
5. Locate the Sentry Service property and select Sentry.
6. Click Save Changes to commit the changes.
7. Restart Solr.

After enabling Sentry for Solr, you may want to configure authorization as described in Configuring Sentry Authorization for Cloudera Search.

Enabling the Sentry Service for Hue

Hue uses a Security app to make it easier to interact with Sentry. When you set up Hue to manage Sentry permissions, make sure that users and groups are set up correctly. Every Hue user connecting to Sentry must have an equivalent OS-level user account on all hosts so that Sentry can authenticate Hue users. Each OS-level user should also be part of an OS-level group with the same name as the corresponding user's group in Hue.

For more information on using the Security app, see the related blog post.

1. Enable the Sentry service for Hive and Impala (as instructed above).
2. Go to the Hue service.
3. Click the Configuration tab.
4. Select Scope > Hue (Service-Wide).
5. Select Category > Main.
6. Locate the Sentry Service property and select Sentry.
7. Click Save Changes to commit the changes.
8. Restart Hue.

Add the Hive, Spark, and Hue Groups to Sentry's Admin Groups

Add the user groups that need administrative privileges on the Sentry Server.

1. Go to the Sentry service.
2. Click the Configuration tab.
3. Select Scope > Sentry (Service-Wide).
4. Select Category > Main.
5. Locate the Admin Groups property and add the hive, spark, and hue groups to the list. If an end user is in one of these admin groups, that user has administrative privileges on the Sentry Server.
6. Click Save Changes to commit the changes.